Efficient Incremental Dynamic Invariant Detection Jeff Perkins Efficient Incremental Dynamic Invariant Detection Jeff Perkins and Michael Ernst MIT CSAIL Page 1 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Dynamic invariant detection Program analysis that generalizes over observed runtime values to hypothesize program properties The result is a set of likely invariants per program point Entry to function binary_search(int[] list, int val) list is sorted list ≠ null val ∈ list Exit from function square(int a) return = a ⋅ a Class Stack this.top = this.stack [ this.top_stack -1] this.stack [ this.top_stack ..] = null Page 2 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Uses of dynamic invariant detection Verifying safety properties [Vaziri 98] [Nimmer 02] Automatic theorem proving [Win 02] Identifying refactoring opportunities [Kataoka 01] Predicate abstraction [Dodoo 02] Generating test cases [Xie 03] [Gupta 03] Selecting and prioritizing test cases [Harder 03] Explaining test failures [Groce 03] Predicting incompatibilities in component upgrades [McCamant 03] Error detection [Raz 02] [Hangal 02] [Pytlik 03] [Mariani 04] [Brun 04] Error isolation [Xie 02] [Liblit 03] Choosing modalities [Lin 04] Page 3 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Goals of this research Handle moderate to large programs Produce useful and expressive program properties Rich set of derived variables array references: a[i] , a[i..] , a[..i] pre-state variables: at exit, orig(x) stands for the value at entry Rich invariant grammar unary, binary, and ternary invariants invariants over pointers, integers, floats, strings and arrays Page 4 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Outline Approaches to invariant detection Simple incremental algorithm Simple incremental algorithm scales poorly Many invariants are redundant Multiple pass approach Multi-pass scales poorly to large data sets Optimized incremental algorithm Complications Results Page 5 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Simple incremental algorithm Hypothesize each invariant in the grammar Over each set of variables At each program point Check observed values for each variable (sample) at each invariant Discard invariants that are falsified The remaining invariants are true over the sample data Examples DIDUCE [Hangal 02] - checks 1 invariant over each variable Carrot [Pytlik 03] - checks 2 unary and 4 binary invariants Daikon version 1 Page 6 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Simple incremental algorithm scales poorly Ternary derived variables (eg, A[i..j]) V = the number of source program variables (at a program point) V D = O(V 3 ) Ternary invariants 3 ) = O(V 9 ) I = O(V D The number of possible invariants in modest test cases ranged from 460 million to 750 million Page 7 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Many invariants are redundant Many invariants are implied by other invariants Examples ( x = y ) ∧ odd( x ) ⇒ odd( y ) ( x = 5 ) ∧ ( y = 6) ⇒ ( x < y ) ( x < y ) ⇒ ( x ≥ y ) ( x ≥ y ) at class Stack ⇒ ( x ≥ y ) at method Stack.top() Page 8 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Multiple pass approach Processes the input data multiple times Early passes check simple invariants Later passes check more complex invariants only if they are not redundant Constants are checked first and removed Equality is checked next. Only one member of an equal set need be checked in following passes The multi-pass approach doesn’t create or check invariants implied by earlier passes (saving both time and space) Example: Daikon version 2 Page 9 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Multi-pass scales poorly to large data sets Even modest traces require gigabytes of space Possible solutions have drawbacks May be too large to store in memory File I/O is expensive and disks may be insufficient for larger traces Running the target program multiple times is often not acceptable Program has side effects Program depends on its environment Program uses expensive resources (such as human attention) Program doesn’t terminate Page 10 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Outline Approaches to invariant detection Optimized incremental algorithm Optimized incremental algorithm concept Constants Equality sets Program point and variable hierarchy program point and variable hierarchy Suppression Complications Results Page 11 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Optimized incremental algorithm concept Same processing model as the simple incremental algorithm Redundant invariants are not instantiated or checked Many invariants are implied by others As long as the antecedents are true, the consequent need be neither instantiated nor checked An invariant must be created when its antecedent is falsified ( x = y ) ∧ odd( x ) ⇒ odd( y ) If a sample is seen where x ≠ y , the odd( y ) invariant must be created The new invariant must be true over all past samples (which are no longer available) The new invariant must be checked over future samples Page 12 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Constants Invariants over (only) constant variables are redundant ( x = 5) ⇒ odd( x ) ( x = 5) ∧ ( y = 6) ⇒ x < y All variables are initially constant Invariants are not instantiated between constants When ( var = constant) is falsified Invariants are instantiated between it and all remaining constants Invariants which are not true over the constant values are discarded Page 13 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Equality sets If two or more variables are equal, any invariant true over one variable is true over all of them ( x = y ) and f( x ) ⇒ f( y ) Initially, all variables are placed in a single equality set One variable (the leader) represents the set Invariants are instantiated only between leaders When ( var1 = var2 ) is falsified The set is split into two or more equality sets Invariants over each old leader are copied to each new leader Page 14 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Program point and variable hierarchy Relationship between program points Class A A.m1() entry A.m1() exit A.m2() entry A.m2() exit Samples are only processed at the leaves of the hierarchy Invariants are created at the parent iff it is true at each child x = y x = y x = y x = y x = y x = y Initially each invariant (e.g., x = y) holds at each leaf Page 15 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins program point and variable hierarchy Relationship between program points Class A A.m1() entry A.m1() exit A.m2() entry A.m2() exit Samples are only processed at the leaves of the hierarchy Invariants are created at the parent iff it is true at each child x = y x = y x = y x = y x = y x = y After processing the invariant was falsified at one program point (red) Page 16 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins program point and variable hierarchy Relationship between program points Class A A.m1() entry A.m1() exit A.m2() entry A.m2() exit Samples are only processed at the leaves of the hierarchy Invariants are created at the parent iff it is true at each child x = y x = y x = y x = y x = y x = y x = y x = y x = y Post processing creates parent invariants Page 17 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins program point and variable hierarchy Relationship between program points Class A A.m1() entry A.m1() exit A.m2() entry A.m2() exit Samples are only processed at the leaves of the hierarchy Invariants are created at the parent iff it is true at each child x = y x = y x = y x = y x = y x = y x = y x = y x = y x = y Post processing creates parent invariants Page 18 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Suppression An invariant can be suppressed if it is logically implied by some set of other invariants. For example: ( x = y ) ∧ ( z = 1) ⇒ x = y ⋅ z ( x = z ) ∧ ( y = 1) ⇒ x = y ⋅ z Other optimizations are special cases of suppression Goals Instantiate/check only non-redundant invariants Use no storage for a non-instantiated invariants When an antecedent is falsified Each invariant that might be suppressed is checked If a suppression held before the antecedent was falsified, but no suppression holds after, the invariant is instantiated Page 19 27 Oct 2004 20:38
Efficient Incremental Dynamic Invariant Detection Jeff Perkins Outline Approaches to invariant detection Optimized incremental algorithm Complications Missing variables Optimizations interact Results Page 20 27 Oct 2004 20:38
Recommend
More recommend
